That was my suspicion as well, according to

spicedb help serve

there is no definition whether this will expect TLS or not. Does it expect TLS?